[Bug 564920] Re: PHP5 under Apache2 on 64 bit system is not completely 64 bit

[Launchpad Bug Tracker]

This bug was fixed in the package php5 - 5.3.2-1ubuntu4.5

---------------
php5 (5.3.2-1ubuntu4.5) lucid-security; urgency=low

  * SECURITY UPDATE: denial of service and possible memory corruption via
    negative size in HTTP chunked encoding stream
    - debian/patches/CVE-2010-1866.patch: prevent chunk_size from
      overflowing in ext/standard/filters.c.
    - CVE-2010-1866
  * SECURITY UPDATE: arbitrary code execution via empty SQL query
    - debian/patches/CVE-2010-1868.patch: use ecalloc instead of emalloc in
      ext/sqlite/sqlite.c.
    - CVE-2010-1868
  * SECURITY UPDATE: denial of service via fnmatch stack consumption
    - debian/patches/CVE-2010-1917.patch: limit size of pattern in
      ext/standard/file.c.
    - CVE-2010-1917
  * SECURITY UPDATE: arbitrary memory disclosure and possible code
    execution via phar extension
    - debian/patches/CVE-2010-2094.patch: use correct format string in
      ext/phar/dirstream.c, ext/phar/stream.c.
    - CVE-2010-2094
    - CVE-2010-2950
  * SECURITY UPDATE: sensitive information disclosure or arbitrary code
    execution via use-after-free in SplObjectStorage unserializer
    - debian/patches/CVE-2010-2225.patch: fix logic in
      ext/spl/spl_observer.c, ext/standard/{php_var.h,var_unserializer.*},
      add tests to ext/spl/tests.
    - CVE-2010-2225
  * SECURITY UPDATE: sensitive information disclosure via error messages
    - debian/patches/CVE-2010-2531.patch: don't display data when flushing
      output buffer in ext/standard/{var.c,php_var.h}, fix tests in
      ext/standard/tests/general_functions.
    - CVE-2010-2531
  * SECURITY UPDATE: arbitrary session variable modification via crafted
    session variable name
    - debian/patches/CVE-2010-3065.patch: handle PS_UNDEF_MARKER marker in
      ext/session/session.c.
    - CVE-2010-3065
  * debian/patches/lp564920-fix-big-files.patch: Fix downloading of large
    files (LP: #564920)
 -- Marc Deslauriers <marc.deslauriers at ubuntu.com>   Fri, 17 Sep 2010 08:14:26 -0400

** Changed in: php5 (Ubuntu Lucid)
       Status: Fix Committed => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-1866

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-1868

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-1917

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-2094

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-2225

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-2531

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-2950

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2010-3065

-- 
PHP5 under Apache2 on 64 bit system is not completely 64 bit 
https://bugs.launchpad.net/bugs/564920
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to php5 in ubuntu.